Are the Personal Data Protection Law (KVKK) policies in Türkiye sufficient?

In this valuable interview with Wise TV, attorney Esra Tekil offers critical insights into the protection of personal data in Turkey, covering the legislative framework, practical implementation, and a notable lack of awareness.

For legal professionals—whether they specialize in European Union processes or other fields—as well as various other experts, the protection of personal data has long been a priority. The significance placed on this issue has been well-recognized since the 1990s, both within the European Union and in the United States. For a long time, however, Türkiye lacked specific regulations in this area. It was only recently that a law on the protection of personal data—modeled after long-standing European Union standards—was enacted. This development was largely driven by necessity: when engaging in business with other countries, organizations are now expected to have established policies and safeguards for personal data protection. While this legislation has been introduced, is it sufficient? Certainly not. Although a Personal Data Protection Authority exists, and certain sectors are subject to rigorous oversight and established requirements, the current regulatory framework still falls far short of where it ought to be. Globally, the European Union’s General Data Protection Regulation (GDPR) represents the gold standard for data protection. While some firms in Türkiye—particularly those operating internationally or serving as local subsidiaries of foreign companies—are required to meet GDPR standards, the broader regulatory landscape in Türkiye remains significantly behind global practices and the protection policies implemented elsewhere in the world. Most importantly, beyond the regulations themselves, we do not take this matter seriously enough in practice. Consequently, both the current regulations and their implementation appear to exist largely only on paper. While many companies have established policies and legal frameworks in compliance with the Personal Data Protection Law (KVKK), there is a significant gap when it comes to actual implementation. These measures are often taken merely to satisfy formal requirements, rather than out of a genuine commitment to the necessary level of care. In Türkiye, there is a general lack of awareness regarding the importance of personal data protection—and information security in, a broader sense. Naturally, sectors such as banking, insurance, and healthcare cannot afford to overlook these issues; they are compelled by regulation to implement certain safeguards. However, looking at the broader landscape—beyond a specific tier of companies—even individuals fail to grasp the significance of their own personal data. Similarly, many businesses do not fully appreciate the critical nature of the information they are obligated to protect, whether it concerns trade secrets, proprietary corporate data, or other sensitive business information. Because this awareness is lacking, the current approach is reduced to a “check-the-box” exercise: registering with the Data Controllers’ Registry (VERBİS), drafting a personal data protection policy, or compiling a data inventory. Yet, for a company to be truly compliant, these measures must be rigorously applied in practice. This entails clearly defining roles and authorization levels, controlling access to specific information, identifying security vulnerabilities—both technical and otherwise—and ensuring that these gaps are effectively addressed. As I mentioned at the beginning, legal, technical, and administrative units must work together on this matter; it requires constant updates and should always remain on the company’s agenda. Currently, the prevailing approach is essentially: “Have we met the legal requirements? Yes, we have.” If an audit occurs, can we prove it? We’ve established our policies, submitted our registration to the Data Controllers’ Registry (VERBİS), and implemented a few technical safeguards. However, these actions are often taken solely out of fear—a desire to avoid trouble or administrative fines during a potential audit—rather than from a genuine recognition of the true value of this data, which is, in fact, a treasure trove of information. There is still a lack of awareness that this data should be protected for the company’s own benefit, rather than merely to escape administrative penalties. I see this as a significant gap.

The European Union and the Protection of Personal Data

The European Union has assumed a pioneering role globally regarding the protection of personal data. Since the 1990s, significant strides have been made in this field, and the protection of personal data has become one of the EU’s core policies. This process has had a profound impact not only within Europe but across the entire world. In particular, the General Data Protection Regulation (GDPR) has established standards for the protection of personal data—standards that have now become a requirement for companies operating internationally.

Protection of Personal Data in Türkiye

Although Turkey has lagged behind the European Union in the protection of personal data, it has taken important steps in this area in recent years. The enactment of the Personal Data Protection Law marks the beginning of a new era for companies in Türkiye. However, the implementation of this law and the level of awareness among companies remain below the desired standard.

Implementation of Regulations and Shortcomings

Regulations concerning the protection of personal data in Türkiye face the risk of remaining merely “on paper.” While many companies may have technically met legal requirements, there are significant shortcomings in actual practice. This indicates that sufficient care is not being taken regarding the protection of personal data.

Awareness and Understanding

The protection of personal data is of great importance not only for companies but also for individuals. Yet, a sufficient level of awareness and understanding on this subject has not yet been achieved in Türkiye. Companies and individuals alike need to exercise greater caution, particularly regarding the protection of trade secrets and private information. Technical and Administrative Measures

The protection of personal data should not be limited solely to legal regulations; technical and administrative measures are also a vital part of this process. Companies must determine who has access to specific information and address any security vulnerabilities. This process requires continuous updates and should remain a priority on the corporate agenda.

Audits and Sanctions

Audits concerning the protection of personal data serve as a deterrent for companies. However, these audits should extend beyond the imposition of administrative fines—they should also foster a greater sense of responsibility and awareness within organizations. Protecting personal data should be viewed not merely as a legal obligation, but as a core value.

Conclusion

The European Union’s pioneering role in the protection of personal data has had a significant global impact. While Turkey has taken important steps in this area, there remain shortcomings in practice. The protection of personal data is not just a legal requirement; it is a matter of consciousness and awareness. If companies and individuals act with greater care and awareness, the process of protecting personal data will function much more effectively.